CVE-2025-1643
Published: 25 February 2025
Summary
CVE-2025-1643 is a medium-severity CSRF (CWE-352) vulnerability in Modernasistemas Modernanet. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 27.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and AC-3 (Access Enforcement).
Deeper analysis
CVE-2025-1643 is a cross-site request forgery (CSRF) vulnerability, rated as problematic, in Benner ModernaNet versions up to 1.1.0. The issue affects the processing of the /DadosPessoais/SG_AlterarSenha endpoint, associated with CWE-352 (Cross-Site Request Forgery) and CWE-862 (Missing Authorization). It carries a CVSS v3.1 base score of 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N), indicating network accessibility with low complexity but requiring user interaction.
Remote attackers without privileges can exploit this vulnerability by tricking authenticated users into performing unintended actions via forged requests to the vulnerable endpoint. Successful exploitation results in low-impact integrity violations, such as unauthorized modifications, with no confidentiality or availability effects.
Advisories recommend upgrading to Benner ModernaNet version 1.1.1 to address the issue. Relevant references include VulDB entries at https://vuldb.com/?ctiid.296693, https://vuldb.com/?id.296693, and https://vuldb.com/?submit.500574, as well as a CVE tracking repository at https://github.com/yago3008/cves.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-4254
Vulnerability details
A vulnerability was found in Benner ModernaNet up to 1.1.0. It has been rated as problematic. This issue affects some unknown processing of the file /DadosPessoais/SG_AlterarSenha. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. Upgrading…
more
to version 1.1.1 is able to address this issue. It is recommended to upgrade the affected component.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CSRF vulnerability in public-facing web application password change endpoint (SG_AlterarSenha) enables exploitation of public-facing application (T1190) and unauthorized account manipulation via forced password change leading to account takeover (T1098).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SC-23 requires mechanisms to protect communications session authenticity, such as anti-CSRF tokens, directly preventing forged requests in this CSRF vulnerability.
SI-10 mandates information input validation, including verification of CSRF tokens or request origins to block unauthorized forged requests to the vulnerable endpoint.
AC-3 enforces approved authorizations for access, addressing the missing authorization (CWE-862) aspect that allows CSRF-induced unauthorized modifications.